Electronic social security card platform access method and system

Abstract

The invention discloses an electronic social security card platform access method and system, and relates to the technical field of information security, and the method comprises the steps: generating business data in a message form according to an electronic social security card service request of a user; encrypting and signing the service message data to generate an HTTP (Hyper Text Transport Protocol) message, and sending an access request to the rear end of the electronic social security card in the form of the HTTP message; when an access credential STOKEN fed back by the rear end of the electronic social security card is received, generating a URL (Uniform Resource Locator) containing the access credential STOKEN; and accessing the front end of the electronic social security card based on the URL, and executing a service operation corresponding to the service data. According to the method, the URL containing the access credential STOKEN is generated through the access credential STOKEN fed back by the rear end of the electronic social security card, the problems of URL playback, hijacking and tampering in the loading process of a channel end are solved, and the risk of non-client operation is reduced by encrypting and signing the service data.

Description

Technical Field

[0001] The present application relates to the field of information security technology, and in particular to an electronic social security card platform access method and system. Background Art

[0002] As a national unified online service platform, the electronic social security card platform needs to meet the technical access requirements of more than 500 channel applications (referring to the apps and mini-program clients of authorized institutions in various industries such as e-government, finance, Internet, and medical care). The platform outputs the electronic social security card H5 application page to each channel application, and through the interactive mode of securely loading the H5 page on the channel side, the channel side provides users with electronic social security card related services. Like other widely used national platforms, the original technical access plan of the electronic social security card platform is: each access channel uses the public key used for signature verification on the electronic social security card platform to generate a signature string of the channel identity according to the agreed signature algorithm, and carries the signature string and the customer information of the business in the URL request to the platform. After verification by the platform, the H5 page can be successfully loaded and the platform service can be entered. At present, there are two mainstream solutions involving H5 interaction: signature operation string superposition transmission encryption and decryption technology and single token superposition transmission encryption technology. For the signature operation string, superposition transmission encryption and decryption technology, this technology is mainly based on signature authentication logic to ensure the authentication of the caller, and does not require the back-end cache corresponding credential information, which puts less cache pressure on the server. However, after the user intercepts the signature string, the intercepted URL can still be used within a certain period of time to re-enter the corresponding address and forge business requests. For the single-token superimposed transmission encryption technology, after invoking H5, the corresponding token is consumed, and the front-end and back-end interactions use encrypted transmission of the corresponding user information. This technology saves the corresponding credentials when the H5 service is invoked, and consumes the corresponding credentials after the service is invoked. It also does not need to cache credential records while the user is using the service, does not require a large amount of caching capacity, and can place the URL to re-enter the corresponding address. However, in this case, although the user information is encrypted, since the front-end code is executed in the browser, it can still be tampered with through technical means.

[0003] At present, although the identity of the access channel can be effectively authenticated, for the customer information transmitted by the channel, only the URL request sent by the channel can be trusted, because it is difficult to fundamentally verify that it is the customer himself, and there is a risk of tampering by attackers; because the electronic social security card platform does not save the user session, all the information of the H5 page called by the channel is assembled in the URL, which makes it difficult to completely prevent the security risks of browser replay. Summary of the invention

[0004] The purpose of this application is to provide an electronic social security card platform access method and system, which can solve the problems of URL replay, hijacking and tampering during the channel-side loading process.

[0005] To achieve the above objectives, this application provides the following solutions:

[0006] In the first aspect, the present application provides a method for accessing an electronic social security card platform, characterized in that the electronic social security card platform includes an electronic social security card front end and an electronic social security card back end; the method for accessing the electronic social security card platform includes: generating business data in the form of a message according to the user's electronic social security card service request; the business message data includes a social security number, name, mobile phone number and channel number; encrypting and signing the business message data to generate an HTTP message, and sending an access request to the electronic social security card back end in the form of the HTTP message; when receiving the access credential S_TOKEN fed back by the electronic social security card back end, generating a URL containing the access credential S_TOKEN; accessing the electronic social security card front end based on the URL, and performing business operations corresponding to the business data.

[0007] In the second aspect, the present application provides a channel server, which includes: a data acquisition module, a data encryption module, a URL generation module and a business operation module; the data acquisition module is used to generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; the data encryption module is used to encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card back end in the form of the HTTP message; the URL generation module is used to generate a URL containing the access credential S_TOKEN when receiving the access credential S_TOKEN fed back by the electronic social security card back end; the business operation module is used to access the electronic social security card front end based on the URL and perform business operations corresponding to the business data.

[0008] On the third aspect, the present application provides an electronic social security card platform access system based on channel-side secure access, and the electronic social security card platform access system based on channel-side secure access specifically includes: a channel APP, a channel service end, an electronic social security card front end and an electronic social security card back end; the channel APP is used to send the user's electronic social security card service request to the channel service end after the user logs in and clicks on the electronic social security card H5 service; the channel service end is used to generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; the business message data is encrypted and signed to generate an HTTP message, and an access request is sent to the electronic social security card back end in the form of the HTTP message; the electronic social security card back end is used to sign, authenticate and decrypt the HTTP message, and generate an access credential S_TOKEN and business message data; the channel server is also used to receive the access credential S_TOKEN and the business message data when receiving the access credential S_TOKEN. When verifying S_TOKEN, a URL including the access credential S_TOKEN is generated, and the URL is sent to the channel APP; the channel APP is also used to access the electronic social security card front end based on the URL to perform business operations corresponding to the business data; the electronic social security card front end is used to intercept the access credential S_TOKEN in the URL, and send the access credential S_TOKEN to the electronic social security card back end; the electronic social security card back end is also used to determine the business data corresponding to the business message data according to the access credential S_TOKEN; consume S_TOKEN, generate X_TOKEN, and cache business data; the electronic social security card front end is also used to initiate a business request to the electronic social security card back end based on X_TOKEN; the electronic social security card back end is also used to call business data according to the business request to complete the request initiated by the electronic social security card front end; the electronic social security card front end is also used to obtain and process business requests, and complete business processing.

[0009] In the fourth aspect, the present application provides an electronic social security card platform access method based on channel-side security access, characterized in that the electronic social security card platform access method based on channel-side security access is applied to the above-mentioned electronic social security card platform access system based on channel-side security access, and the electronic social security card platform access method based on channel-side security access specifically includes: through the channel APP, after the user logs in and clicks on the electronic social security card H5 service, the user's electronic social security card service request is sent to the channel service end; through the channel service end, business data in the form of a message is generated according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; the business message data is encrypted and signed to generate an HTTP message, and an access request is sent to the electronic social security card back end in the form of the HTTP message; through the electronic social security card back end, the HTTP message is signed, authenticated and decrypted to generate an access credential S_TOKEN and a business message document data; through the channel server, when the access credential S_TOKEN is received, a URL containing the access credential S_TOKEN is generated, and the URL is sent to the channel APP; through the channel APP, the electronic social security card front end is accessed based on the URL, and the business operation corresponding to the business data is performed; through the electronic social security card front end, the access credential S_TOKEN in the URL is intercepted, and the access credential S_TOKEN is sent to the electronic social security card back end; through the electronic social security card back end, the business data corresponding to the business message data is determined according to the access credential S_TOKEN; S_TOKEN is consumed, X_TOKEN is generated, and business data is cached; through the electronic social security card front end, a business request is initiated to the electronic social security card back end based on X_TOKEN; through the electronic social security card back end, business data is obtained according to the business request, and the request initiated by the electronic social security card front end is completed; through the electronic social security card front end, the business request is obtained and processed, and the business processing is completed.

[0010] According to the specific embodiments provided by this application, this application discloses the following technical effects: This application generates a URL containing the access credential S_TOKEN based on the access credential S_TOKEN fed back by the electronic social security card backend, thereby solving the problems of URL replay, hijacking and tampering during the channel loading process, and reducing the risk of operations by non-customers by encrypting and signing business data. BRIEF DESCRIPTION OF THE DRAWINGS

[0011] In order to more clearly illustrate the embodiments of the present application or the technical solutions in the prior art, the drawings required for use in the embodiments will be briefly introduced below. Obviously, the drawings described below are only some embodiments of the present application. For ordinary technicians in this field, other drawings can be obtained based on these drawings without paying creative work.

[0012] Figure 1 A process of accessing an electronic social security card platform provided in an embodiment of the present application Figure 1 .

[0013] Figure 2 A process of accessing an electronic social security card platform provided in an embodiment of the present application Figure 2 .

[0014] Figure 3 A structural diagram of an electronic social security card platform access method provided in an embodiment of the present application.

[0015] Figure 4 A flowchart of an electronic social security card platform access method based on channel-side secure access provided in an embodiment of the present application. DETAILED DESCRIPTION

[0016] The following will be combined with the drawings in the embodiments of the present application to clearly and completely describe the technical solutions in the embodiments of the present application. Obviously, the described embodiments are only part of the embodiments of the present application, not all of the embodiments. Based on the embodiments in the present application, all other embodiments obtained by ordinary technicians in this field without creative work are within the scope of protection of this application.

[0017] In order to make the above-mentioned objects, features and advantages of the present application more obvious and easy to understand, the present application is further described in detail below with reference to the accompanying drawings and specific implementation methods.

[0018] Embodiment 1, as Figure 1-Figure 2 As shown, the present application provides a method for accessing an electronic social security card platform, wherein the electronic social security card platform includes an electronic social security card front end and an electronic social security card back end; the method for accessing the electronic social security card platform includes:

[0019] Step S101, generating business data (business message data) in message form according to the user's electronic social security card service request; the business message data includes social security number, name, mobile phone number and channel number.

[0020] Step S102, generating business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number.

[0021] Optionally, social security number, name, and mobile phone number together constitute user information.

[0022] Optionally, the business message data is constructed by the channel server based on user information and channel code when the user logs in to the channel APP, clicks on the electronic social security card H5 service, and jumps to the channel server.

[0023] Step S103, encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message.

[0024] Optionally, an HTTP message is constructed according to the attribute name, timestamp, signature information, channel identifier and encrypted business message data of the business message data, specifically including: using the attribute name, timestamp, signature information and channel identifier of the encrypted business data as the header of the HTTP message, using the encrypted business data as the body of the HTTP message, to construct the HTTP message.

[0025] Furthermore, the business message data is encrypted and signed to generate an HTTP message, specifically including: encrypting the confidential fields in the business message data using the SM4 key to obtain encrypted business message data; summarizing the encrypted business message data using the SM3 algorithm to obtain message summary information; signing the message summary information and timestamp using the SM2 private key to obtain signature information; and constructing an HTTP message based on the attribute name, timestamp, signature information, channel identifier and encrypted business message data of the business message data.

[0026] Step S104, when the access credential S_TOKEN fed back by the electronic social security card backend is received, a URL containing the access credential S_TOKEN is generated.

[0027] Furthermore, the business data is stored in the form of key-value pairs with S_TOKEN.

[0028] Furthermore, the S_TOKEN is a one-time token.

[0029] Furthermore, the S_TOKEN is a security token.

[0030] Furthermore, the S_TOKEN is a token generated by a snowflake algorithm.

[0031] Step S105, accessing the electronic social security card front end based on the URL, and executing business operations corresponding to the business data.

[0032] Embodiment 2, as Figure 3 As shown, the present application also provides a channel server, which includes: a data acquisition module 201, a data encryption module 202, a URL generation module 203 and a business operation module 204.

[0033] The data acquisition module 201 is used to generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number.

[0034] The data encryption module 202 is used to encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message.

[0035] The URL generation module 203 is used to generate a URL containing the access credential S_TOKEN when receiving the access credential S_TOKEN fed back by the electronic social security card backend.

[0036] The business operation module 204 is used to access the electronic social security card front end based on the URL and perform business operations corresponding to the business data.

[0037] Example 3, the present application also provides an electronic social security card platform access system based on channel-side secure access, and the electronic social security card platform access system based on channel-side secure access specifically includes: channel APP 301, channel service end 302, electronic social security card front end 303 and electronic social security card back end 303.

[0038] The channel APP 301 is used to send the user's electronic social security card service request to the channel server after the user logs in and clicks on the electronic social security card H5 service.

[0039] The channel service end 302 is used to generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; the business message data is encrypted and signed to generate an HTTP message, and an access request is sent to the electronic social security card backend in the form of the HTTP message.

[0040] In the actual application process, the channel APP server first generates business message data (including social security number, name, mobile phone number and channel number), and agrees on the corresponding confidential fields in accordance with the configuration annotation. Use the assigned SM4 key to encrypt the confidential fields that need to be encrypted using the SM4 algorithm to obtain the encrypted business message data. Use the SM3 algorithm to perform a summary algorithm on the encrypted business message data to obtain the message summary information. Use the SM2 private key held by the channel server to sign the message summary information and timestamp information. Obtain the signature information. Put the encrypted attribute name, timestamp, signature information, and channel identifier in the HTTP message header, and put the encrypted business message data in the body. Then initiate a request to the backend of the electronic social security card electronic platform to obtain the access credential S_TOKEN.

[0041] The electronic social security card backend 304 is used to perform signature authentication and decryption on HTTP messages, and generate access credentials S_TOKEN and business message data.

[0042] In the actual application process, the electronic social security card backend obtains the encrypted business message data in the HTTP message request body, and uses the SM3 algorithm to obtain the message summary information. At the same time, the encrypted attribute name, timestamp, signature information and channel identifier in the HTTP request are parsed. Then the SM2 public key and SM4 key of the corresponding channel are obtained through the channel identifier, and the message summary information and signature information are verified using the SM2 public key. If the verification is wrong, an error is returned. If the verification is correct, the encrypted business message data is decrypted according to the encrypted attribute name using the SM4 key to obtain the business message data. Then an S_TOKEN is generated. The S_TOKEN and business message data are stored in the cache in the form of key-value pairs. Return the S_TOKEN to the channel server.

[0043] The channel server 302 is also used to generate a URL containing the access credential S_TOKEN when receiving the access credential S_TOKEN, and send the URL to the channel APP; the URL is obtained by concatenating the URL link of the channel APP and the S_TOKEN.

[0044] The channel APP 301 is also used to access the electronic social security card front end based on the URL and perform business operations corresponding to the business data.

[0045] The electronic social security card front end 303 is used to intercept the access credential S_TOKEN in the URL and send the access credential S_TOKEN to the electronic social security card back end.

[0046] The electronic social security card backend 304 is also used to determine the business data corresponding to the business message data according to the access credential S_TOKEN; consume the S_TOKEN, generate the X_TOKEN, and cache the business data; the X_TOKEN is a session token generated by the snowflake algorithm. The X_TOKEN can be used repeatedly within a preset time.

[0047] In the actual application process, the S_TOKEN in the URL request will be consumed in step S6. Even if the URL request is hijacked, it cannot be entered again. After receiving the URL request at the back end of the electronic social security card, the S_TOKEN in the URL request is parsed, and then the business data in the cache is queried through the S_TOKEN. If it cannot be obtained, an error is returned. If the information is obtained, an X_TOKEN is generated, and the X_TOKEN and business data are cached in the form of key-value pairs, and the key-value pair cache data of the S_TOKEN and business data is deleted. The X_TOKEN is returned to the front end of the electronic social security card service platform. The X_TOKEN and business data are stored in the electronic social security card platform in the form of key-value pairs.

[0048] The electronic social security card front end 303 is also used to initiate a business request to the electronic social security card back end based on X_TOKEN.

[0049] The electronic social security card backend 304 is also used to call business data according to business requests to complete the request initiated by the electronic social security card frontend; optionally, the interface used to call business data is the get_token interface of the electronic social security card backend.

[0050] The electronic social security card front end 303 is also used to obtain and process business requests and complete business processing.

[0051] Embodiment 4, as Figure 4 As shown, the present application also provides an electronic social security card platform access method based on channel-side secure access, and the electronic social security card platform access method based on channel-side secure access is applied to the electronic social security card platform access system based on channel-side secure access described above, and the electronic social security card platform access method based on channel-side secure access specifically includes:

[0052] 401. Through the channel APP, after the user logs in and clicks on the electronic social security card H5 service, the user's electronic social security card service request is sent to the channel server.

[0053] 402. Generate business data in the form of a message through the channel server according to the user's electronic social security card service request; encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message; the business message data includes the social security number, name, mobile phone number and channel number.

[0054] 403. Through the electronic social security card backend, the HTTP message is signed, authenticated and decrypted to generate access credentials S_TOKEN and business message data.

[0055] 404. Through the channel server, when the access credential S_TOKEN is received, a URL including the access credential S_TOKEN is generated, and the URL is sent to the channel APP.

[0056] 405. Through the channel APP, access the electronic social security card front end based on the URL and perform business operations corresponding to the business data.

[0057] 406. Through the electronic social security card front end, intercept the access credential S_TOKEN in the URL, and send the access credential S_TOKEN to the electronic social security card back end.

[0058] 407. Through the electronic social security card backend, determine the business data corresponding to the business message data according to the access credential S_TOKEN; consume S_TOKEN, generate X_TOKEN, and cache the business data.

[0059] 408. Through the electronic social security card front end, a business request is initiated to the electronic social security card back end based on X_TOKEN;

[0060] 409. Through the electronic social security card backend, obtain business data according to the business request and complete the request initiated by the electronic social security card front end.

[0061] 410. Obtain processing business requests through the electronic social security card front end and complete business processing.

[0062] Furthermore, the HTTP message is signed and authenticated and decrypted, including:

[0063] Obtain the encrypted business message data, the attribute name of the business message data, the timestamp, the signature information and the channel identifier in the HTTP message.

[0064] The encrypted service message data is summarized using the SM3 algorithm to obtain message summary information.

[0065] Get the SM2 public key and SM4 private key based on the channel ID.

[0066] The SM2 public key is used for signature authentication based on the message summary information and timestamp.

[0067] After the signature authentication is passed, the encrypted business message data is decrypted using the SM4 key to obtain the business message data.

[0068] The present application provides an electronic social security card platform access method and system, which generates a URL containing the access credential S_TOKEN based on the access credential S_TOKEN fed back by the electronic social security card backend, solves the problem of URL replay, hijacking and tampering during the channel end loading process, and reduces the risk of non-customer operation by encrypting and signing the business data. Among them, the channel service end calls the electronic social security card backend to obtain the S_TOKEN consumed once, and uses it as the root to bring in subsequent interactions. This mechanism ensures that illegal access cannot be made by hijacking the URL spliced ​​by the channel backend (the URL entering the front end of the electronic social security card), ensuring the security of channel access, preventing URL replay, URL request hijacking and tampering, and ensuring the security of personal sensitive information. By generating X_TOKEN, the security of the session within the validity period is guaranteed. Specifically, the dual token technology used in this application solves these three problems in the following way: the channel itself generates a public key and private key pair based on the SM2 algorithm, and submits the public key to the electronic social security card service platform. The private key is held by this channel and is used for local specific business signatures. When calling the interface, the bus control platform of the electronic social security card verifies the channel identity. Ensure the identity security of the interface caller. When H5 is invoked, it is necessary to obtain an S_TOKEN through the back-end interface that verifies the channel identity. This S_TOKEN is valid once and becomes invalid immediately after the verification. This prevents malicious users from repeatedly re-entering the service of valid users by intercepting requests initiated by valid users. While consuming the S_TOKEN, an X_TOKEN is returned to associate the user information passed in by the channel. The customer request cannot be forged by replacing the user information in the middle. The overall design idea of ​​the solution is to use several key atomic interfaces to associate the originally split business logic. Each key atomic interface must have the information of a key atomic interface before it can enter the subsequent interface. This ensures the non-forgeability and non-reentrancy of the service.

[0069] It should be pointed out that the electronic social security card service in this application is a service provided by our company to governments at all levels, human resources and social security, government departments, banks, medical institutions, third-party service agencies, etc. This application mainly protects the channel security access technology of the electronic social security card from infringement or encroachment by third parties.

[0070] The technical features of the above embodiments may be combined arbitrarily. To make the description concise, not all possible combinations of the technical features in the above embodiments are described. However, as long as there is no contradiction in the combination of these technical features, they should be considered to be within the scope of this specification.

[0071] This article uses specific examples to illustrate the principles and implementation methods of this application. The description of the above embodiments is only used to help understand the method and core ideas of this application. At the same time, for those skilled in the art, according to the ideas of this application, there will be changes in the specific implementation methods and application scope. In summary, the content of this specification should not be understood as limiting this application.

Claims

1. A method for accessing an electronic social security card platform, characterized in that: The electronic social security card platform includes an electronic social security card front end and an electronic social security card back end; the electronic social security card platform access method includes: Generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; Encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message; When receiving the access credential S_TOKEN fed back by the electronic social security card backend, generate a URL containing the access credential S_TOKEN; Access the electronic social security card front end based on the URL and perform business operations corresponding to the business data.

2. The electronic social security card platform access method according to claim 1, characterized in that: Encrypting and signing the service message data to generate an HTTP message specifically includes: Encrypt the confidential fields in the business message data using the SM4 key to obtain encrypted business message data; The encrypted service message data is summarized using the SM3 algorithm to obtain message summary information; Sign the message summary information and timestamp using the SM2 private key to obtain signature information; Construct an HTTP message based on the attribute name, timestamp, signature information, channel identifier and encrypted business message data of the business message data.

3. The electronic social security card platform access method according to claim 1, characterized in that: The business data is stored in the form of key-value pairs with S_TOKEN.

4. The method for accessing the electronic social security card platform according to claim 1, characterized in that: The S_TOKEN is a one-time token.

5. The electronic social security card platform access method according to claim 1, characterized in that: The S_TOKEN is a security token.

6. The electronic social security card platform access method according to claim 1, characterized in that: The S_TOKEN is a token generated by the Snowflake algorithm.

7. A channel service end, characterized in that: The channel service end includes: a data acquisition module, a data encryption module, a URL generation module and a business operation module; The data acquisition module is used to generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; The data encryption module is used to encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message; The URL generation module is used to generate a URL containing the access credential S_TOKEN when receiving the access credential S_TOKEN fed back by the electronic social security card backend; The business operation module is used to access the electronic social security card front end based on the URL and perform business operations corresponding to the business data.

8. An electronic social security card platform access system based on channel-side secure access, characterized in that: The electronic social security card platform access system based on channel-side secure access specifically includes: channel APP, channel service end, electronic social security card front end and electronic social security card back end; The channel APP is used to send the user's electronic social security card service request to the channel server after the user logs in and clicks on the electronic social security card H5 service; The channel service end is used to generate business data in the form of a message according to the user's electronic social security card service request; the business message data includes the social security number, name, mobile phone number and channel number; encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message; The electronic social security card backend is used to perform signature authentication and decryption on HTTP messages, and generate access credentials S_TOKEN and business message data; The channel server is further configured to generate a URL containing the access credential S_TOKEN upon receiving the access credential S_TOKEN, and send the URL to the channel APP; The channel APP is also used to access the electronic social security card front end based on the URL and perform business operations corresponding to the business data; The electronic social security card front end is used to intercept the access credential S_TOKEN in the URL and send the access credential S_TOKEN to the electronic social security card back end; The electronic social security card backend is also used to determine the business data corresponding to the business message data according to the access credential S_TOKEN; consume the S_TOKEN, generate the X_TOKEN, and cache the business data; The electronic social security card front end is also used to initiate a business request to the electronic social security card back end based on X_TOKEN; The electronic social security card backend is also used to call business data according to business requests to complete the request initiated by the electronic social security card frontend; The electronic social security card front end is also used to obtain and process business requests and complete business processing.

9. A method for accessing an electronic social security card platform based on secure access to a channel end, characterized in that: The electronic social security card platform access method based on channel-side secure access is applied to the system according to claim 8, and the electronic social security card platform access method based on channel-side secure access specifically includes: Through the channel APP, after the user logs in and clicks on the electronic social security card H5 service, the user's electronic social security card service request is sent to the channel server; Generate business data in the form of a message through the channel service end according to the user's electronic social security card service request; encrypt and sign the business message data to generate an HTTP message, and send an access request to the electronic social security card backend in the form of the HTTP message; the business message data includes the social security number, name, mobile phone number and channel number; Through the electronic social security card backend, the HTTP message is signed, authenticated and decrypted to generate access credentials S_TOKEN and business message data; When receiving the access credential S_TOKEN, the channel server generates a URL containing the access credential S_TOKEN and sends the URL to the channel APP; Through the channel APP, access the electronic social security card front end based on the URL and perform business operations corresponding to the business data; Through the electronic social security card front end, intercept the access credential S_TOKEN in the URL, and send the access credential S_TOKEN to the electronic social security card back end; Through the electronic social security card backend, determine the business data corresponding to the business message data according to the access credential S_TOKEN; consume S_TOKEN, generate X_TOKEN, and cache business data; Through the electronic social security card front end, a business request is initiated to the electronic social security card back end based on X_TOKEN; Through the electronic social security card backend, business data is obtained according to business requests to complete the request initiated by the electronic social security card frontend; Through the electronic social security card front end, obtain and process business requests and complete business processing.

10. The method for accessing the electronic social security card platform based on channel-side secure access according to claim 9, characterized in that: Signature authentication and decryption of HTTP messages, including: Obtain encrypted business message data, attribute name of business message data, timestamp, signature information and channel identifier in HTTP message; The encrypted service message data is summarized using the SM3 algorithm to obtain message summary information; Get the SM2 public key and SM4 private key based on the channel ID; Use SM2 public key to perform signature authentication based on message summary information and timestamp; After the signature authentication is passed, the encrypted business message data is decrypted using the SM4 key to obtain the business message data.

Images